URL encode and decode

How do you encode text for a web address?

Percent-encode text for a web address, or decode %20 and friends back to plain text.

Conversion

Text to encode

Encode as

For one piece such as a query value or a path segment. Escapes every character that has a meaning in an address, so ? & = / # all become %-codes.

Encoded

Hello%20world%20%26%20caf%C3%A9%3F

19 characters become 34

How to use

Choose Encode to make text safe for a web address, or Decode to read an encoded address.
Type or paste the text. If decoding finds a mistake, it tells you at which character.
Pick what you are encoding under Encode as: one part of an address, a whole address, or form data.
Copy the result.

Common characters encoded as an address part

Character	Encoded
+	%2B
&	%26
=	%3D
/	%2F
%	%25
?	%3F

How it works

A web address can only hold a small set of characters. Anything else, such as a space, an accent, an emoji, or a character that has a special meaning like ? and &, is written as a percent sign and two hex digits for each byte: a space becomes %20 and é becomes %C3%A9. Text is turned into bytes as UTF-8 first (RFC 3986, section 2.1).

What to leave alone depends on where the text goes. For one piece of an address, such as a search term in a query, everything with a meaning is escaped, so an & in your text cannot be mistaken for the start of the next parameter. For a whole address, the characters that structure it, such as / ? & = and #, are kept so the address still works. Form data is like a piece of an address, except that a space is written as + (ECMAScript encodeURIComponent and encodeURI; WHATWG URL Standard).

Decoding needs a valid code. A % without two hex digits after it, or escapes that are not valid UTF-8, cannot be turned back into text, and the tool says where the problem starts. Encoding is not encryption: anyone can decode the result.

Frequently asked questions

Should I encode the whole address or just a part?

Encode just the part you are inserting, such as a search term or a file name. Encoding a whole address as a part would also escape its slashes and colons and break it.

What is the difference between %20 and +?

Both can mean a space. %20 works everywhere in an address. + means a space only in form data and many query strings, so a real plus sign has to be written %2B.

Why does decoding say my text is invalid?

Usually a stray % sign, such as in 100% sure, or a half-copied code like %E2%82. Write a literal percent sign as %25.

Does encoding hide sensitive information in a URL?

No. Percent-encoding is reversible. It does not encrypt a password or token.

Why does an encoded percent sign become %25?

The percent sign introduces an escape. Encoding it as %25 lets the decoder distinguish a literal percent sign from an escape sequence.

More in Web & developer

All 18 utilities in Web & developer